ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a VPC with multiple subnets across Availability Zones. An application uses a Network Load Balancer (NLB) to distribute traffic to instances. The security team notices that traffic from a specific client IP is being dropped. The NLB access logs show the client IP, but the target instances do not receive the traffic. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The target group health checks are failing, so the NLB is not sending traffic to those targets
If target group health checks fail, the NLB stops sending traffic to the unhealthy targets, even though the client IP is logged by the NLB. The traffic is dropped because NLB does not forward to unhealthy targets. Options B and C are incorrect because network ACLs or security groups would only affect traffic after NLB sends it, but health check failure prevents traffic from being sent at all. Option D is incorrect because NLB does not have security groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The target group health checks are failing, so the NLB is not sending traffic to those targets
Why this is correct
If health checks fail, the NLB marks the target as unhealthy and stops sending traffic.
- ✗
The target subnet network ACL blocks the client IP
Why it's wrong here
NACLs affect traffic to the instance, but the NLB would still forward traffic unless the target is unhealthy.
- ✗
The target instance security group does not allow traffic from the NLB
Why it's wrong here
If the security group blocked traffic, the NLB would still forward it, but the instance would drop it. The question says the instances do not receive traffic.
- ✗
The NLB security group blocks the client IP
Why it's wrong here
NLBs do not have security groups.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,621 original ANS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.